Pattern: Opaque Client-Held State Is the Agent Stack's Newest Leak Surface

arXiv·high signalXBlueskyLinkedInCopy link

The reasoning-trace paper shows encrypted chain-of-thought blocks are portable across sessions, users, and models, and that they carried recoverable PII and credentials into public repositories — meaning state you treated as an opaque vendor blob was actually plaintext you were publishing. The structural cause is that providers pushed reasoning state to the client to avoid server-side storage, making it the client's liability without the client knowing. The defensive rule that follows: any vendor-opaque blob in a session transcript should be scrubbed before that transcript is logged, committed, or shipped to a trace store — treat it as secret material, not metadata.